Privileged groups in Active Directory are groups granted powerful rights, privileges, and permissions that allow near-complete control over Active Directory and domain-joined systems. Adding a new account to such a group can introduce significant risk.

A Global Administrator can manage all aspects of Microsoft Entra ID and any Microsoft services that use Entra identities. Adding a new account to such a powerful role can introduce significant risk.

Conditional Access policies enforce critical access controls such as multi-factor authentication and device compliance. Modifying or deleting a policy can weaken the organization's security posture and open an attack path.

With External Identities, formerly known as Guests, people outside your organization can access apps and resources while signing in with their own identity. Depending on tenant settings, member users can invite guests, who may then gain access to sensitive data.

Some groups have access to sensitive data, so it is important to monitor when guest accounts are added to a group.

Depending on a team's settings, guest users may gain access to sensitive data. Changes to guest permissions should be monitored.

In Exchange Online, delegating the Send As permission lets another user send messages that appear to come from the mailbox. Such delegation can expose sensitive data or enable impersonation.